Press CTRL+K to open search

Using an unlock code to uncontain a Linux host

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

This section describes how to use the unlock code to uncontain your Linux host.

To use an unlock code to remove a Linux host from containment:

  1. Log in to the contained Linux host as a root user.

  2. At the shell prompt, use the cd command to change to the /opt/Trellix/XClient/bin/uncontain directory:

    cd /opt/Trellix/XClient/bin/uncontain

  3. Run the uncontain executable file with the unlock code:

    ./uncontain <unlock code>

Related articles
  • Using an unlock code to uncontain a Linux host
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Containing host endpoints > Manage containment > Stopping containment using an unlock code
  • Using an unlock code to uncontain a Windows host
    Endpoint Detection and Response with Forensics (EDRF) > Respond to threats with EDRF > Containment and remediation > Containing host endpoints > Manage containment > Stopping containment using an unlock code
  • Using an unlock code to uncontain a macOS host
    Endpoint Detection and Response with Forensics (EDRF) > Respond to threats with EDRF > Containment and remediation > Containing host endpoints > Manage containment > Stopping containment using an unlock code